GlobalProtect : Cached Portal Configuration
44782
Created On 01/31/20 02:12 AM - Last Modified 07/02/20 18:56 PM
Symptom
- If the GlobalProtect Client is unable to connect to a GP Portal, it will attempt to reference a cached GP Portal configuration.
Environment
- GlobalProtect Clients
- PanOS
Resolution
- The GP cached Portal configuration is referenced by a combination of a GP Username and and Portal address (i.e. different combinations of usernames and GP portal addresses could result in different cached Portal configurations)
- When a connection is made to the GP Portal, the Portal configuration is downloaded and the cached configuration is updated for that username and Portal combination.
- Usernames can be retrieved from the following sources:
- Single Sign On - the username is retrieved from the credentials supplied for the device logon (for example Windows PC domain login)
- saved user credentials - in the GP Portal Agent configurations under the Authentication tab, the administrator can choose "Save User Credentials" and set it to "yes" or to "save username only". In this case the username is stored and will be used to reference the cached portal configuration.
NOTE: if "Save User Credentials" is set to "no", then the username is not saved and this cannot be used to reference a cached portal configuration.
- typed username - if the GP client prompts for a username, the typed username will be used for cached portal
- client certificate - if using client certificate authentication the username can be present in the common name or the subject alternative name of the certificate.
NOTE during the first time use - the GP client has never connected to a GP Portal before so there will not be a cached Portal configuration.